Cornerstone of Privacy, Compliance and Information Security Management

2© all rights reserved, www.GRC2020.com
James Mackay, Chief Revenue Officer
Michael Rasmussen, J.D., GRCP, CCEP
GRC Pundit

Key Takeaways:
- User engagement is a critical part of a successful policy management system
- Consistency is critical to define clear rules of approach to Policy creation
- Policy awareness enables a dialogue on important issues that can typically be
forgotten in the day to day running of a business
- Policy management has become a critical part of organisational oversight

Policies
Cornerstone of Privacy, Compliance and Information Security Management
Michael Rasmussen, J.D., GRCP, CCEP
The GRC Pundit @ GRC 20/20 Research, LLC
OCEG Fellow @ www.OCEG.org

Policy Management Pressures
• Brainstorm all potential stakeholders, individuals and groups associated with the project.
ETHICS
THREATS
MEDIA
PCI DSS
IT PROJECTS
RELIABLY
ACHIEVE
OBJECTIVES
REPUTATION
& BRAND

Realize that everything connects to everything else.
Leonardo da Vinci

The Chaos of Risk Interconnectedness

Change is the Greatest Challenge Impacting Policy Management

… Confusing Policy Management User Experience

Policy Discovery & Inventory: Do You Know Where Your Policies Are?

Titelmasterformat durch Klicken bearbeiten
GRC is the integrated collection of
capabilities that enable an organization to:
G) reliably achieve objectives
R) while addressing uncertainty and
C) acting with integrity.
SOURCE: OCEG GRC Capability Model
Policies are a foundation for all aspects of GRC . . .

What is Your Approach to Policy Management?
 An integrated approach that balances policy
management centralization with distributed
participation and collaboration
Federated Policy Management
 Disconnected departments managing policies in
different ways with little or no collaboration with other
departments
Distributed Policy Management

Policy Management Maturity Improvement: a Top Down Approach
Policy Management Strategy
Policy Management Technology
Policy Management Information
Policy Management Process

Design a Suitable & Scalable System

GRC 20/20’s Effective Policy Management Lifecycle
Determine
Need
Measure
& Maintain
Monitor
& Enforce
Communicate
& Train
Develop
& Approve1 2 3 4 5

Determine Policies that Need to be Changed
Determine
Need
Measure
& Maintain
Monitor
& Enforce
Communicate
& Train
Develop
& Approve1 2 3 4 5

Draft the Policy, Review It, Edit It, and Approve It
Determine
Need
Measure
& Maintain
Monitor
& Enforce
Communicate
& Train
Develop
& Approve1 2 3 4 5

Policy Team Approves Plan & Initiates Communication
Determine
Need
Measure
& Maintain
Monitor
& Enforce
Communicate
& Train
Develop
& Approve1 2 3 4 5

Monitor & Enforce Involves Related Procedures, Controls, and Assessments
Determine
Need
Measure
& Maintain
Monitor
& Enforce
Communicate
& Train
Develop
& Approve1 2 3 4 5

Preserve an Audit Trail and System of Records of All Policy Interactions
VERSION (DATE/TIME) ASK & RESOLVE QUESTIONS
MANAGE EXCEPTIONS
UNDERSTAND CONTEXT PROVIDE AUDITABLE RECORDS
DEMONSTRATE SEQUENCE
MEET REQUIREMENTS
REPEATABLE CYCLE
Contact info@oceg.org for comments, reprints or licensing requests ©2017 OCEG

 Organizations often lack an
auditable means of policy
maintenance, communication,
attestation, and training.
 An ad hoc approach to policy
management exposes the
organization to significant liability.
 If policy documentation doesn’t
conform to an orderly style and
structure the organization is not
positioned to drive desired
behaviors in corporate culture or
enforce accountability.
Technology Enables Efficient, Effective & Agile Policy & Training Management
The bottom line: With today’s complex business operations,
global expansion, and the ever changing legal, regulatory and
compliance environments, a well-defined policy management
program is vital to enable an organization to effectively develop
and maintain the wide gamut of policies it needs to govern with
integrity.

Policy Information Architecture Provides 360° Contextual Intelligence
Strategic
Financial
Operational
Preventive
Corrective
Detective
Complaint
Investigation
Event
Strategic
Process
Department
Regulatory
Values
Contractual
Code of
Conduct
Training & Awareness
Policies & Procedures
Owner
Employee
Subject Matter Expert
Controls
Risks
Issues
Roles
Objectives
Policies
Obligations
Organization
Entity
Asset
Process

Policy Management Technology Enables Management of Policy Processes
COLLABORATIONAUDIT TRAIL ENFORCEMENT
MANAGEMENT REPORTING
WORKFLOW &
TASKS

Benefits of Technology

Deliver a Unified Company Policy Portal in the Format Needed

An Engaging User Experience for Policy Management

GRC 20/20‘S Policy Management Maturity Model
AD HOC
Existing policies are in a
state of disorganization
Oral tradition takes
precedence over written
policy
Roles and responsibilities
not defined
No methodology
Technology is scattered.
1
FRAGMENTED
Policies are written but not
maintained
Little understanding of
effectiveness of policies
Policies are inconsistent in
template and language
No standardized
methodology
Technology is scattered
DEFINED
Key policies are managed
and maintained within
department
Terms, templates, and
style is consistent at
department level
Standardized
methodology at
department level
Technology enabled
INTEGRATED
Silos of policies are begun
to be broken down
Cross-department
methodology, style,
template and process
Use of policy technology
across departments
Integrated training and
support
AGILE
Centralized policy
management for entire
organization
Integrated learning
environment
Forms automation and
helpline
Integrated information with
other GRC areas
Accountability monitored
2
3
4
5
AD HOC
FRAGMENTED
DEFINED
INTEGRATED
AGILE

Questions?
Michael Rasmussen, J.D.
The GRC Pundit & OCEG Fellow
mkras@grc2020.com
+1.888.365.4560
Some of the content we have evaluated is OCEG content which GRC 20/20 has an established relationship to use. Please do not copy
slides or graphics without permission. GRC 20/20 highly recommends you consider OCEG membership at www.OCEG.org.
GRC 20/20 Newsletter
LinkedIn: GRC 20/20
Blog: GRC Pundit
Twitter: GRCPundit
LinkedIn: Michael Rasmussen

Helping you to build a modern Cyber Security
and Compliance Culture

End to end cyber security and compliance solution

Contact:
- metacompliance.com
- info@metacompliance.com
- +44 (0)28 7135 9777
- http://www.metacompliance.com/gdpr/gdpr-for-dummies/

Cornerstone of Privacy, Compliance and Information Security Management

Cornerstone of Privacy, Compliance and Information Security Management

Recommended

Recommended

More Related Content

Similar to Cornerstone of Privacy, Compliance and Information Security Management

Similar to Cornerstone of Privacy, Compliance and Information Security Management (20)

Recently uploaded

Recently uploaded (20)

Cornerstone of Privacy, Compliance and Information Security Management

Editor's Notes